https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-where-if-results-under-quot-query-quot/m-p/623138#M216633 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/139947">@YangThomas</a>,</P><P>in a subsearch you have to use the exact fieldnames of the main search, in other words i you want to match the hostname field (in the lookup) with the host field in the search, you have to rename it.</P><P>I don't understand what you want to match with the "query" field, also because query is a special name in SPL, anyway if query is a field both in the lookup and the main search, you could try something like this:</P><LI-CODE lang="markup">index=opendns [ | inputlookup hosts | rename hostname AS host | table host query]</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sun, 04 Dec 2022 18:13:53 GMT gcusello 2022-12-04T18:13:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-where-if-results-under-quot-query-quot/m-p/623137#M216632 <P>Currently using splunkes' managed lookup table called hosts. There's a field too called hostname within the file.<BR /><BR />I'm trying to create a search where if results under "query" field matches anything under hostname, then alert or show results.</P> <P>here's what I have so far..</P> <P class="lia-align-left lia-indent-padding-left-60px"> </P> <LI-CODE lang="markup">index=opendns [ | inputlookup hosts | search hostname | table hostname query]</LI-CODE> <P> </P> Mon, 05 Dec 2022 12:39:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-where-if-results-under-quot-query-quot/m-p/623137#M216632 YangThomas 2022-12-05T12:39:39Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-where-if-results-under-quot-query-quot/m-p/623138#M216633 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/139947">@YangThomas</a>,</P><P>in a subsearch you have to use the exact fieldnames of the main search, in other words i you want to match the hostname field (in the lookup) with the host field in the search, you have to rename it.</P><P>I don't understand what you want to match with the "query" field, also because query is a special name in SPL, anyway if query is a field both in the lookup and the main search, you could try something like this:</P><LI-CODE lang="markup">index=opendns [ | inputlookup hosts | rename hostname AS host | table host query]</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sun, 04 Dec 2022 18:13:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-where-if-results-under-quot-query-quot/m-p/623138#M216633 gcusello 2022-12-04T18:13:53Z